openrisc: fix arbitrary kernel memory access via or1k_atomic syscallgrafted

sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>

1 files changed, 92 insertions, 0 deletions

diff --git a/drivers/pinctrl/meson/Kconfig b/drivers/pinctrl/meson/Kconfig
new file mode 100644
index 000000000..1af4fc320
--- /dev/null
+++ b/drivers/pinctrl/meson/Kconfig
@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: GPL-2.0-only
+menuconfig PINCTRL_MESON
+	tristate "Amlogic SoC pinctrl drivers"
+	depends on ARCH_MESON || COMPILE_TEST
+	depends on OF
+	default ARCH_MESON
+	select PINMUX
+	select PINCONF
+	select GENERIC_PINCONF
+	select GPIOLIB
+	select REGMAP_MMIO
+
+if PINCTRL_MESON
+
+config PINCTRL_MESON8
+	bool "Meson 8 SoC pinctrl driver"
+	depends on ARM || COMPILE_TEST
+	select PINCTRL_MESON8_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON8B
+	bool "Meson 8b SoC pinctrl driver"
+	depends on ARM || COMPILE_TEST
+	select PINCTRL_MESON8_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON_GXBB
+	tristate "Meson gxbb SoC pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON8_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON_GXL
+	tristate "Meson gxl SoC pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON8_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON8_PMX
+	tristate
+
+config PINCTRL_MESON_AXG
+	tristate "Meson axg Soc pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON_AXG_PMX
+	tristate
+
+config PINCTRL_MESON_G12A
+	tristate "Meson g12a Soc pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON_A1
+	tristate "Meson a1 Soc pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+config PINCTRL_MESON_S4
+	tristate "Meson s4 Soc pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+config PINCTRL_AMLOGIC_A4
+	bool "AMLOGIC pincontrol"
+	depends on ARM64 || COMPILE_TEST
+	default ARCH_MESON
+	help
+	  This is the driver for the pin controller found on Amlogic SoCs.
+
+	  This driver is simplify subsequent support for new amlogic SoCs,
+	  to support new Amlogic SoCs, only need to add the corresponding dts file,
+	  no additional binding header files or C file are added.
+
+config PINCTRL_AMLOGIC_C3
+	tristate "Amlogic C3 SoC pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+config PINCTRL_AMLOGIC_T7
+	tristate "Amlogic T7 SoC pinctrl driver"
+	depends on ARM64 || COMPILE_TEST
+	select PINCTRL_MESON_AXG_PMX
+	default ARCH_MESON
+
+endif